Request for Proposal (RFP) for DPO Upskilling Initiative: Consultancy Services (Lot 1 and Lot 2)

REQUEST FOR PROPOSAL (RFP)

DPO Upskilling Initiative: Consultancy Services (Lot 1 and Lot 2)

RFP Number: 008/TCPA/2026

Date: September 24, 2026

Program:KoraLink Program: DPO Upskilling Initiative

Implementing Organization:The Commons Project Foundation, Africa (TCP Africa)

Location:Rwanda (two KoraLink-active pilot districts near Kigali, one urban and one rural)

Duration:Lot 1: October 2026 to March 2027; Lot 2: October 2026 to September 2027

Reporting to:Program Director, TCP Africa

I. Context

The Commons Project Foundation, Africa (TCP Africa) is driving a person-centered digital health revolution across Africa by building interoperable digital platforms that enhance healthcare accessibility and empower individuals with secure, verifiable access to their health data. Headquartered in Kigali, Rwanda, TCP Africa partners with governments, foundations, and ecosystem stakeholders to digitize healthcare systems, build a skilled digital health workforce, and strengthen personal ownership of health data.

TCP Africa implements the KoraLink program in partnership with the Rwanda ICT Chamber and the Society for Family Health (SFH). KoraLink is a flagship demonstration initiative that creates digital jobs in health for youth, especially young women, while strengthening Rwanda’s digital health infrastructure. KoraLink Agents are trained as digital community entrepreneurs delivering health products and essential digital services while earning sustainable livelihoods; 80–90% of them are women.

Rwanda’s Law nº 058/2021 of 13 October 2021 relating to the protection of personal data and privacy (the “DPP Law”) requires public and private bodies that process personal data to designate a Data Protection Officer (DPO) (Article 40), to register with the supervisory authority and keep that registration current (Articles 29–33), and to notify data breaches within 48 hours with a full report within 72 hours (Articles 43–44). Non-compliance is sanctioned as administrative misconduct under Article 53.

The DPO Upskilling Initiative responds to this gap by training KoraLink Agents as data protection practitioners, competent to be designated as DPOs under Article 40, and deploying them at sector and district level under the service-contract arrangement that Article 40 permits. Entry is at Senior 6 (A2) level or equivalent, including recognised prior learning. Training is delivered at two levels, Basic (sector posts) and Advanced (district posts); every graduate is certified as both a Data Protection Officer and a Data Analyst, at approximately 120 hours per level, delivered 60% in person and 40% online through a mobile-first, offline-capable learning management information system (LMIS).

A twelve-month pilot runs from October 2026 to September 2027 in two KoraLink-active districts near Kigali, delivering two cohorts and an independent endline evaluation that will inform a national scale-up decision covering all 30 districts and 416 sectors. Graduates are certified by a certifying body contracted separately by TCP Africa, through the Digital Inclusion Sector Skills Council.

2. Purpose of the Assignment

TCP Africa (the “Contracting Authority”) invites proposals from qualified consulting firms or consortia of firms to execute the DPO Upskilling Initiative under two Lots:

• Lot 1: Curriculum Design and Validation.Adaptation and finalisation of the full blended curriculum for both levels and both professional strands, mapping to the DPP Law and NCSA DPO competencies, assessment design, LMIS-ready content production, and facilitation of employer validation through to curriculum lock.
• Lot 2: Training and Certification.Recruitment and preparation of the trainer pool, delivery of two blended pilot cohorts, learner assessment, management of the certification pathway, presentation of graduating cohorts to NCSA, and deployment readiness of graduates.

Bidders may apply for one or both Lots. Because assessment and certification must remain independent of training delivery, the Lot 2 consultant delivers training, administers formative assessment and prepares candidates, but does not set, mark or moderate the summative assessment on which certification depends; that function is contracted separately to the certifying body. Award of both Lots to a single bidder is at the discretion of the Contracting Authority and subject to demonstrated capacity to run both workstreams in parallel. A bidder awarded both Lots must ring-fence the two teams, and personnel who authored a module may not assess learners on that module.

3. Guiding Principles (Both Lots)

• Legal fidelity: all content, assessment and certification activity must be grounded in the DPP Law and mapped to the DPO duties in Article 41 and to the controller and processor obligations on which the officer advises (Articles 37, 42, 46, 47, 51 and 52). The GDPR and the Malabo Convention are treated only as context for cross-border transfers.
• Senior 6 accessibility: materials pitched for learners with an upper-secondary certificate, in accessible English with Kinyarwanda facilitation throughout, a validated Kinyarwanda glossary of data protection terms, and all learner-facing job aids in both Kinyarwanda and English.
• Dual-profession, two-level structure:every module serves the combined DPO and Data Analyst pathway; Basic equips sector posts and Advanced equips district posts.
• Blended and online-ready:the pilot is 60% in person, but the sustainable model is 80–100% online, so all content must be LMIS-ready, mobile-first, offline-capable and instrumented to generate delivery-mode evidence.
• Gender responsiveness and inclusion:the pipeline is 80–90% women and the program targets at least 70% female participation; design and delivery must be gender-responsive and must reasonably accommodate learners with disabilities.
• Role independence: no graduate may serve as DPO and Data Analyst for the same data controller.
• Data protection by example:see Section 9 below.

4. Scope of Work: Lot 1, Curriculum Design and Validation

Objective: to produce a complete, validated and locked curriculum covering the Data Protection and Data Analytics strands at Basic and Advanced levels, mapped to the DPP Law and NCSA DPO competencies, approved by employers at a validation workshop and locked before Cohort 1 begins.

Task 1.1: Inception and curriculum audit

• evaluate the existing curriculum (curriculum guide, course outlines, week-by-week delivery schedule and assessment design across six tracks, including Data Privacy Law, Data Governance and Business Intelligence) and the validated Data Protection curriculum.
• perform a gap analysis against the program design: the Article 41 duty map, the two-level structure, Senior 6 entry, the 120-hour envelope per level and the module list in the program proposal.
• Produce an inception report with a curriculum development plan, module inventory (adapt / new-build) and a validation and lock schedule consistent with the October 2026 curriculum-lock milestone.

Task 1.2: Curriculum architecture and legal mapping

• Design the curriculum architecture: learning outcomes, module sequence, hours allocation (approximately 72 in-person and 48 online hours per level) and progression logic from Basic to Advanced.
• Map every module to the DPO duties under Articles 40–41 and to NCSA DPO competencies, documented in a traceability matrix.
• Ensure explicit coverage of: registration, change reporting and renewal (Articles 29–33, 36); breach notification and reporting (Articles 43–45); storage in Rwanda and cross-border transfers (Articles 48–50); lawful bases (Article 46); information at collection (Article 42); security measures (Article 47); retention and destruction (Article 52); data migration on change or closure of business (Article 51); data subject rights and requests; sanctions (Article 53); DPIAs and high-risk processing; and the institutional diagnostic methodology used before deployment.
• Upload all content to the KoraLink program-managed LMIS.

Task 1.3: Module adaptation and new development

• Adapt existing courses to Senior 6 entry level and the two-level structure across both strands.
• create new modules on: incident and breach response (Articles 43–45); the registration and designation process and the NCSA register; the independence, reporting line and conflict-of-interest position of the designated officer; and sector-specific applied modules for health, education, finance and public administration.
• create the Data Analytics strand: data literacy and quality, de-identification, pseudonymisation and safe aggregation, spreadsheet analysis and routine reporting (Basic); multi-source consolidation, indicator analysis against targets, dashboards and district briefs (Advanced).
• Produce all learner materials, facilitator guides, session plans, practical exercises and case studies drawn from Rwandan sector- and district-level realities.

Task 1.4: Assessment design

• Design the assessment framework: entry baseline instruments, formative module assessments, pre/post competency tests, the supervised practicum (including the institutional diagnostic as the first piece of assessed professional work) and summative assessments per level.
• Co-create the assessment standard with the certifying body and obtain its formal acceptance, so that certification can proceed without redesign.
• Define pass thresholds, resit rules, moderation procedures and the evidence each learner file must contain.

Task 1.5: LMIS-ready content production

• Produce the online share of each level in LMIS-ready form: mobile-first, offline-capable, chunked for low-connectivity completion, with embedded knowledge checks.
• Tag every component for delivery-mode analytics (completion, time on task, assessment results per module) so the pilot can determine which content can move fully online from Cohort 3 onward.

Task 1.6: Validation and curriculum lock

• produce and facilitate the employer validation and commitment workshop, including pre-reads, structured evaluate instruments and a disposition log of all feedback.
• Incorporate validated feedback, obtain written sign-off from the Contracting Authority, NCSA and the certifying body, and deliver the locked curriculum package by the end of October 2026.
• After Cohort 1, perform one structured revision cycle using delivery evidence, facilitator observation and assessment analytics, and deliver Curriculum v1.1 before Cohort 2 begins (March 2027).

5. Scope of Work: Lot 2, Training and Certification

Objective: to deliver two blended pilot cohorts (60% in person, 40% online) to the locked curriculum in the two pilot districts; to assess learners and oversee the certification pathway through to digital credentials and the formal presentation of each graduating cohort to NCSA (subject to NCSA’s prior written agreement); and to leave behind a quality-assured trainer pool and the delivery evidence the pilot evaluation requires.

Task 2.1: Mobilisation and trainer pool

• Recruit, screen and contract a facilitator pool sufficient for parallel delivery in both pilot districts, drawing where useful on local delivery associates, under the Contracting Authority’s quality assurance.
• Design and run a train-the-trainer program on the locked curriculum, facilitator guides, LMIS, Senior 6-appropriate pedagogy and gender-responsive facilitation; certify facilitators as delivery-ready before Cohort 1.
• produce delivery logistics jointly with the Contracting Authority: venues in each district, the twelve in-person training days per cycle, learner onboarding onto the LMIS, and device and connectivity troubleshooting for offline study.

Task 2.2: Cohort delivery (Cohorts 1 and 2)

• Deliver Cohort 1 (60 trainees, November 2026 to February 2027) and Cohort 2 (60 trainees, March to June 2027) in both pilot districts, per Annex 1 (Cohort Composition): Basic level for sector-post trainees and Advanced level for district-post trainees, approximately 120 hours per level (72 in person and 48 online).
• oversee online delivery through release schedules, completion monitoring, learner assist and follow-up of learners falling behind, using module-level analytics.
• Supervise the practicum, including each trainee’s institutional diagnostic. The diagnostic is limited to documentation, policy and process evidence; trainees must not access, copy, photograph or remove personal data held by the host institution. Confidentiality undertakings and written host authorisation are required before the diagnostic begins, and every learner evidence file must be screened for third-party personal data.
• keep attendance, engagement and safeguarding records, and retain at least the enrolled ratio of female participation (target ≥70%) through active retention assist.
• Incorporate Cohort 1 lessons and Curriculum v1.1 into Cohort 2, and document all delivery-mode evidence for the endline evaluation.

Task 2.3: Assessment

• Administer the baseline, formative and pre/post assessments at both levels with full records per learner, and present candidates to the certifying body for summative assessment.
• perform internal quality assurance of formative assessment, assist the certifying body’s independent moderation, and oversee resits within the framework’s rules.
• Compile a complete, verifiable learner evidence file for every candidate presented for certification.

Task 2.4: Certification pathway management

• organize the certification process with the certifying body, which independently verifies graduates and certifies them through the Digital Inclusion Sector Skills Council. Certification decisions rest solely with the certifying body.
• assist issuance of verifiable digital credentials and population of the graduate registry (level, strand results and assignment records needed to enforce role separation), and document the registry’s lawful basis, retention period, access controls and data subject rights procedure.
• Organise, with the Contracting Authority, the formal presentation of each graduating cohort to NCSA, and assist alignment of graduate records with NCSA’s DPO designation register.

Task 2.5: Deployment readiness and handover

• Deliver a deployment-readiness component in the final phase of each cohort: professional perform, the shared-DPO service model, the role-independence rule, the registration-first protocol for unregistered host institutions, and the service-plan approach arising from the institutional diagnostic.
• deliver graduate competency profiles to the placement function and the graduate services company to inform assignment matching.
• Hand over the certified trainer pool, all delivery and assessment records, LMIS analytics extracts, a delivery lessons report per cohort, and a certificate confirming the secure return or deletion of all personal data processed under the assignment.

6. Key Deliverables and Payment Schedule

Payments are made against deliverables accepted in writing by the Contracting Authority and are subject to applicable Rwandan taxes and withholding.

Lot 1: Curriculum Design and Validation

Lot 2: Training and Certification

7. Required Qualifications and Experience

Bidding firm or consortium

• Legal registration in Rwanda (RDB) and valid NCSA registration as a data controller/processor; for consortia, a signed consortium agreement naming the guide firm.
• Demonstrated experience in data protection and privacy training, curriculum design or certification, preferably including Rwanda’s DPP Law.
• Experience designing or delivering blended and mobile-first learning for learners at secondary-school entry level in low-connectivity settings.
• For Lot 2: experience delivering training at scale in Rwanda, with Kinyarwanda facilitation and gender-responsive, inclusive delivery.
• Experience securing institutional endorsement or formal approvals (e.g. from regulators, sector skills councils or ministries).

Proposed key personnel

• Lot 1: Team Leader / Curriculum guide; Data Protection Legal Expert with Rwandan law expertise; Data Analytics Specialist; Instructional and e-learning Designer; Kinyarwanda language and terminology specialist.
• Lot 2: Training guide; pool of facilitators fluent in Kinyarwanda and English; Assessment and Quality Assurance Officer; Gender and Safeguarding Focal Person; LMIS and learner assist coordinator.
• Relevant professional certifications (for example CIPP/E, CIPM, CDPO or ISO/IEC 27001/27701) are an advantage.

8. Management & Coordination

The selected firm(s) will be contracted by TCP Africa and report to the Program Director, TCP Africa. The consultant(s) will work closely with the National Cyber Security Authority (NCSA), the Ministry of Health, the certifying body, the Digital Inclusion Sector Skills Council, the pilot district and sector authorities, KoraLink program partners and employers. Where both Lots are awarded to one bidder, the two teams must be ring-fenced as described in Section 2.

9. Data Protection and Intellectual Property

• For the purposes of the DPP Law the consultant acts as a data processor. It must hold a valid registration under Articles 29–31, execute the Contracting Authority’s data processing agreement before any personal data is shared, and keep a record of the processing carried out under the assignment.
• All trainee and institutional data must be handled in Rwanda in line with Article 50 of the DPP Law and the Contracting Authority’s ISO/IEC 27001-certified information security management system. Course materials will be hosted on the Contracting Authority’s learning platform.
• All curriculum, assessment instruments, facilitator guides and LMIS content vest in TCP Africa upon payment, with a licence to the Ministry of Health, NCSA and the certifying body. The consultant may not re-use the materials for any other client without TCP Africa’s prior written consent.

10. Evaluation Criteria

Proposals will be evaluated separately for each Lot using the criteria below.

11. Submission of Proposal

Interested firms or consortia are invited to submit electronically, as a single PDF per Lot, the following:

• Technical proposal: company profile, relevant experience, understanding of the assignment, proposed approach and methodology, the engagement sequence with the Ministry, NCSA and districts, and a work plan against the deliverables and timeline in Section 6.
• CVs of key personnel: no more than four pages each.
• Financial proposal: all-inclusive fees by deliverable, with daily rates and number of working days per team member, inclusive of all taxes, travel and incidental costs, in Rwandan Francs (RWF).
• References: three referees from comparable assignments.
• Administrative documents:RDB registration certificate, valid RRA tax clearance, RSSB clearance, NCSA registration certificate and, for consortia, the consortium agreement.

Proposals must be sent toprocurement@thecommonsproject.org no later than September 30, 2026 at 5pm, with the subject line “DPO Upskilling Initiative: Lot 1” or “DPO Upskilling Initiative: Lot 2”. Questions and requests for clarification should be sent to the same address by September 25, 2026 at 5pm. Only shortlisted bidders will be contacted.

Equal Opportunity Employer

TCP Africa is an equal opportunity employer. We value a workplace that is diverse in terms of gender, race, class, age, geographic origin, sexual orientation, and other differences that enrich our society. We encourage offerors from all cultures, races, colors, religions, sexes, national or regional origins, ages, disability status, sexual orientation, gender identity, military, protected veteran status or other status protected by law, and those who may not meet every requirement listed in the scope of work.

[End of RFP]